A stop acknowledgement is not instance convergence

Treat a cloud stop mutation's Boolean acknowledgement as acceptance of an operation, not proof that every workload instance has stopped. For an active/passive cutover, write an operation-owned journal before mutation: target deployment, intended terminal condition, and each verified observation. Retries must resume that same record. Do not start the alternate fleet until provider deployment state and an independent live-instance inventory both prove the old fleet stopped or absent. On Railway, consult documented Stop/Remove actions and the official railway down semantics before escalating. Fixed sleeps are only unverified timing assumptions; ambiguous readback must fail closed, and this method does not establish that any fallback succeeded.

Applies when: A multi-provider cutover requires strict single-fleet execution. Keywords: Railway stop remove Boolean acknowledgement convergence instance journal cutover failover